function hook_pthread_create() {
    var pt_create_func = Module.findExportByName("libc.so", 'pthread_create');

    Interceptor.attach(pt_create_func, {
        onEnter: function (args) {
            // 是那个so文件调用我，创建线程
            var so_name = Process.findModuleByAddress(args[2]).name;
            if (so_name.indexOf("libmsaoaidsec.so") != -1) {
                try {
                    Interceptor.replace(args[2], new NativeCallback(function () {
                        console.log('replace success');
                        return null;
                    }, 'void', ["void"]));
                } catch (e) {
                    console.log(e);
                }

            }
        }, onLeave: function (retval) {
        }
    })
}


// csdn上的方法
function web_hook_pthread_create(){
    var find_module = Process.findModuleByName("libmsaoaidsec.so");
    console.log("libmsaoaidsec.so --- " + find_module)

    Interceptor.attach(Module.findExportByName("libc.so", "pthread_create"),{
        onEnter(args){
            var methods_ptr = args[2]
            var method_count = parseInt(args[3]);
            console.log("The thread function address is " , methods_ptr)
            // for (var i = 0; i < method_count; i++) {
            //         // Java中函数名字的
            //         var name_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3));
            //         // 参数和返回值类型
            //         var sig_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize));
            //         // C中的函数指针
            //         var fnPtr_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize * 2));
            //
            //         var name = Memory.readCString(name_ptr); // 读取java中函数名
            //         var sig = Memory.readCString(sig_ptr); // 参数和返回值类型
            //         var find_module = Process.findModuleByAddress(fnPtr_ptr); // 根据C中函数指针获取模块
            //
            //         var offset = ptr(fnPtr_ptr).sub(find_module.base) // fnPtr_ptr - 模块基地址
            //         console.log("name:", name, "sig:", sig, "module_name:", find_module.name, "offset:", offset);
            // }
        }
    })
}

// hook_pthread_create();
web_hook_pthread_create();

// frida -H 127.0.0.1:8877 -l  7_hook_pthread.js -f cn.soulapp.android
// frida -U -f cn.soulapp.android -l  7_hook_pthread.js -f cn.soulapp.android